Class Action Filed Over Oct. 2021 Planned Parenthood Data Breach Affecting More Than 400,000 Patients [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Planned Parenthood Los Angeles faces a proposed class action that alleges an October 2021 data breach stemmed from the facility’s negligent failure to secure patients’ highly sensitive information. 

The 24-page complaint says the personally identifiable information of more than 400,000 Planned Parenthood patients nationwide was exposed in the breach, which started around October 9 and was not discovered until October 17, 2021. The lawsuit says that files extracted by the unauthorized party behind the incident included patient names, dates of birth, addresses, insurance identification numbers and clinical data, including diagnoses, treatment and prescription details. 

According to the suit, Planned Parenthood failed to properly safeguard patient data despite having been hacked in 2015 and 2020. The lawsuit calls this latest incident “particularly egregious” in light of numerous other high-profile cybersecurity attacks and data breaches of late. 

The lawsuit stresses that the kind of information exfiltrated in the Planned Parenthood data breach is extremely sensitive in nature given the abortion and family planning services and sexually transmitted disease testing the facility provides, and the current moment in which the constitutionality of certain abortion laws is under attack. 

“Because Planned Parenthood provides these highly private services—and because it has become a lightning rod for public debate around abortion restrictions—the exfiltrated information, including Plaintiff’s identity, is of the utmost sensitivity,” the lawsuit says. “Particularly given its highly confidential nature, the information compromised in the Data Breach is valuable to hackers, who may try to sell it on the black market.” 

The case argues that the timing of the Planned Parenthood data breach makes it more likely that hackers will exploit the stolen information or seek ransom payments for its return. Victims affected by the data breach will face a significant threat of identity theft and other harm for years to come, according to the filing. 

The lawsuit says a letter sent by Planned Parenthood around November 30, 2021 informed patients of the breach and advised them to take protective measures. The letter stated Planned Parenthood experienced “suspicious activity” on its computer network and that an unauthorized party or parties removed certain files. 

Planned Parenthood is bound by the federal Health Insurance Portability and Accountability Act (HIPAA) to ensure that patients’ health information is kept private, and to timely notify the individuals when a breach occurs, the lawsuit says. 

The lawsuit looks to cover all United States citizens and residents whose personally identifiable information was in Planned Parenthood’s electronic information systems and was compromised as a result of the October 2021 breach. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.